Bug#847812: pysolfc: crash on startup

[Markus Koschany]

Control: reassign -1 src:pillow
Control: tags -1 patch
Control: forwarded -1 https://github.com/python-pillow/Pillow/issues/1902

On Sun, 11 Dec 2016 16:21:12 -0700 Ben Hildred <42656e at gmail.com> wrote:
> Package: pysolfc
> Version: 2.0-4
> Severity: grave
> Justification: renders package unusable
>
> $  pysolfc
> Traceback (most recent call last):
>   File "/usr/games/pysolfc", line 32, in <module>
>     sys.exit(main(sys.argv))
>   File "/usr/share/games/pysolfc/pysollib/main.py", line 359, in main
>     r = pysol_init(app, args)
>   File "/usr/share/games/pysolfc/pysollib/main.py", line 196, in pysol_init
>     app.loadImages1()
>   File "/usr/share/games/pysolfc/pysollib/app.py", line 712, in loadImages1
>     im = loadImage(fn)
>   File "/usr/share/games/pysolfc/pysollib/tile/tkutil.py", line 276, in
> makeImage
>     im = PIL_Image(file)
>   File "/usr/share/games/pysolfc/pysollib/tile/tkutil.py", line 254, in
> __init__
>     ImageTk.PhotoImage.__init__(self, image)
>   File "/usr/lib/python2.7/dist-packages/PIL/ImageTk.py", line 120, in __init__
>     self.paste(image)
>   File "/usr/lib/python2.7/dist-packages/PIL/ImageTk.py", line 187, in paste
>     _imagingtk.tkinit(tk.interpaddr(), 1)
> OverflowError: Python int too large to convert to C long

Hello,

I am reassigning #847812 to src:pillow because it is not a bug in pysolfc. The game is currently
unplayable on 32 bit architectures thus the severity.

The reason for the overflow error stems from the fact that the return value of tk.interpaddr() is
too big to fit into a Py_ssize_t on 32 bit. A solution that works for me is to use PyLong_AsVoidPtr
in _imagingtk.c instead. The patch was taken from matplotlib [1] which appears to borrow some code
from pillow. The issue is also known upstream as bug #1902.

Please note that pillow currently can't be compiled due to its python-olefile build-dependencies. I
am attaching the debdiff to this bug report.

Regards,

Markus


[1] https://github.com/matplotlib/matplotlib/commit/a91559b82cf23ee407cd57580653015fc7dc35f0



-------------- next part --------------
diff -Nru pillow-4.0.0/debian/changelog pillow-4.0.0/debian/changelog
--- pillow-4.0.0/debian/changelog	2017-01-05 19:47:03.000000000 +0100
+++ pillow-4.0.0/debian/changelog	2017-01-09 10:11:41.000000000 +0100
@@ -1,3 +1,11 @@
+pillow (4.0.0-1.1) UNRELEASED; urgency=medium
+
+  * Non-maintainer upload.
+  * Add imagingtk-int-overflow.patch. Fix integer overflow on 32 bit
+    architectures.
+
+ -- Markus Koschany <apo at debian.org>  Mon, 09 Jan 2017 10:11:41 +0100
+
 pillow (4.0.0-1) unstable; urgency=medium
 
   * Pillow 4.0.0 release.
diff -Nru pillow-4.0.0/debian/control pillow-4.0.0/debian/control
--- pillow-4.0.0/debian/control	2017-01-05 19:47:03.000000000 +0100
+++ pillow-4.0.0/debian/control	2017-01-09 10:11:41.000000000 +0100
@@ -10,7 +10,6 @@
   python-tk, python-tk-dbg,
   python3-tk, python3-tk-dbg,
   python-nose, python3-nose,
-  python-olefile, python3-olefile,
   libfreetype6-dev, libjpeg-dev, zlib1g-dev, liblcms2-dev,
   libtiff5-dev | libtiff-dev, libwebp-dev
 Build-Conflicts: python-cffi, python3-cffi
diff -Nru pillow-4.0.0/debian/patches/imagingtk-int-overflow.patch pillow-4.0.0/debian/patches/imagingtk-int-overflow.patch
--- pillow-4.0.0/debian/patches/imagingtk-int-overflow.patch	1970-01-01 01:00:00.000000000 +0100
+++ pillow-4.0.0/debian/patches/imagingtk-int-overflow.patch	2017-01-09 10:11:41.000000000 +0100
@@ -0,0 +1,39 @@
+From: Markus Koschany <apo at debian.org>
+Date: Mon, 9 Jan 2017 10:11:13 +0100
+Subject: imagingtk int overflow
+
+Fix integer overflow on 32 bit architectures.
+
+Forwarded: https://github.com/python-pillow/Pillow/issues/1902
+Origin: https://github.com/matplotlib/matplotlib/commit/a91559b82cf23ee407cd57580653015fc7dc35f0
+---
+ _imagingtk.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/_imagingtk.c b/_imagingtk.c
+index 87de36a..db16468 100644
+--- a/_imagingtk.c
++++ b/_imagingtk.c
+@@ -36,18 +36,18 @@ _tkinit(PyObject* self, PyObject* args)
+ {
+     Tcl_Interp* interp;
+ 
+-    Py_ssize_t arg;
++    PyObject *arg;
+     int is_interp;
+-    if (!PyArg_ParseTuple(args, "ni", &arg, &is_interp))
++    if (!PyArg_ParseTuple(args, "Oi", &arg, &is_interp))
+         return NULL;
+ 
+     if (is_interp)
+-        interp = (Tcl_Interp*) arg;
++        interp = (Tcl_Interp*)PyLong_AsVoidPtr(arg);
+     else {
+         TkappObject* app;
+ 	/* Do it the hard way.  This will break if the TkappObject
+ 	   layout changes */
+-        app = (TkappObject*) arg;
++        app = (TkappObject*)PyLong_AsVoidPtr(arg);
+         interp = app->interp;
+     }
+ 
diff -Nru pillow-4.0.0/debian/patches/series pillow-4.0.0/debian/patches/series
--- pillow-4.0.0/debian/patches/series	2016-08-11 10:23:07.000000000 +0200
+++ pillow-4.0.0/debian/patches/series	2017-01-09 10:11:41.000000000 +0100
@@ -1,3 +1,4 @@
 no-lib64-hack.diff
 toplevel-setup.py
 generate-webp-file
+imagingtk-int-overflow.patch
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 963 bytes
Desc: OpenPGP digital signature
URL: <http://lists.alioth.debian.org/pipermail/pkg-games-devel/attachments/20170109/8f72ce39/attachment.sig>